Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gitea | Gitea | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 01 Nov 2026 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a configured OAuth2 provider could submit another user's name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required. | |
| Title | Gitea OAuth2 account auto-linking takeover through the sign-up form | |
| Weaknesses | CWE-287 CWE-639 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-11-01T09:47:09.191Z
Reserved: 2026-11-01T08:48:41.149Z
Link: CVE-2026-120263
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-01T10:18:37.520
Modified: 2026-11-01T10:18:37.637
Link: CVE-2026-120263
Redhat
No data.
OpenCVE Enrichment
No data.